Here’s the super high level summary of the Meta Ray-Ban’s Bluetooth protocol (DataX/Airshield framework), based on traffic capture, decompiling the Meta Wearable SDK, and disassembling the Meta AI app:

To connect:

Get PSM (port) for the L2cap connection by looking at BLE service ID FD5F and characteristic 05ACBE9F-6F61-4CA9-80BF-C8BBB52991C0

this is 4 bytes - the last 2 bytes (little endian) is the PSM

Open L2cap connection

Datax sends messages on “channels”; each channel is connected to a “service”

Both the phone and the device do this handshake:

This is all done in native code even in the Android phone app/SDK. Once the initial connection is open, though, other services are implemented in Java on the Android Meta AI app and SDK.

For pairing in the Meta AI App, the phone app sends IdentityRequest after opening the connection.

When I tested connecting to the device, the device also opens:

• channel 0x1e (identity/applinks) and sends com.oculus.applinks.EnableTrust
• channel 0x4f (CONSTELLATIONAUTH) and sends com.meta.constellationauth.EnableTrust

The SDK doesn’t have the applinks service (not sure if the phone app does), but does have code for handing CONSTELLATIONAUTH, including sending app manifests - this is probably how it checks if the SDK app is allowed.